C vulnerabilities

Question

I was reading about the vulnerabilities in strings in C and then I came across this code. Could anyone give me an explanation why this is vulnerable? Thanks in advance.

`strcpy` copies `strlen + 1` characters. What happens when `strlen(str) == MAXSIZE`? — , May 15 '21 at 08:36
Writing beyond the bounds of an array is undefined behavior. Look at your `while` loop. Do you think that `j` will always be between `0` and `9`? And as mentioned, your `strcpy` call is unsafe. — Tom Karzes, May 15 '21 at 08:37

score 1 · Answer 1 · answered May 15 '21 at 09:11

char buf[MAXSIZE];
if (strlen(str) > MAXSIZE)
    return;
strcpy(buf, str);

This code incorrectly check for maximum length. C string have a nul at the end of the string to mark the end of the string. strcpy() will copy it. To accomodate for this nul, the test must be:

if (strlen(str) >= MAXSIZE)

The code below is also incorrect. int i[10]; int j = 0;

while (j < 10000){
    i[j] = 5;                
    ++j;
}

This code will overwrite the data in memory after the 10 integers of array i. This will create an undefined behavior, probably a crash but maybe something more subtle...

C vulnerabilities

1 Answers1